In general, implementing the two-man rule requires the use of authorization-helpers to implement the work flow. Most of these helpers are delivered as for-fee software. If the value of your time to engineer and maintain your own solution is less than the licensing costs of the for-fee software, then you could always write or cobble-together your own solution (e.g., you could always put sudo membership control under an external service like Puppet or Salt, then let your membership control be enforced by one person and your actual login/sudo action would be performed by the actual systems administrator).